Splunk Search

Timechart hour span for one week isn't showing breakdown

Scottindc
Explorer

It's showing all the hours for each day but groups all activity at midnight of each day instead of through the day. This is my output query -

| timechart span=1hour count by PlatformName limit=50

How do I get the breakdown for each hour in the day to show?

alt text

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

If you've configured the saved search populating the summary index to run only once a day, (and the rows you're sending into the summary index don't have _time values), then the summary will only ever have events at midnight on each day, and that will be your problem here.

it's important when setting up summary indexing to use a time interval that will be able to give you the granularity that you need.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Knowledge/Usesummaryindexing

Excerpt from that page: "Remember that searches that populate summary indexes should run on a fairly frequent basis in order to create statistically accurate final reports. If the search you're running against the summary index is gathering information for the past week, you should have the summary search run on an hourly basis, collecting information for each hour. If you're running searches over the past year's worth of data, you might have the summary index collect data on a daily basis for the past day."

If you're running the summary index search at midnight because the system is generally underutilized then, and say your search was like ... | stats count by username, then there's another way to up the granularity of summary data from one day to one hour, by changing the search to this:

... | bin _time span="1h" | stats count by username, _time

Even if you only run that once a day, the rows it's sending into the summary index have a _time field, and unless you've spceially configured your SI config, it'll use that _time field when it creates the new rows, meaning that you can have 1-hour granularity on your timecharts later.

Scottindc
Explorer

What's the best way to fix this?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I guess your summary index only contains events from just after midnight then.

0 Karma

Scottindc
Explorer

Pardon, I'm very new to Splunk. This is the full query -

index="summary" search_name="si_http_programID_platform_format" earliest="-7day@day" latest="-0day@day" | timechart span=1hour count by PlatformName limit=50

martin_mueller
SplunkTrust
SplunkTrust

What's the full query? Also, make sure your timestamps are parsed correctly.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...